GigaWiper is a modular, Golang-compiled backdoor first observed conducting destructive wiping activity in October 2025 and publicly disclosed by Microsoft on 2026-07-09. It is architecturally distinctive for consolidating THREE previously distinct malware lineages into a single 20-command implant rather than deploying them as separate tools: (1) a standalone physical-disk wiper that is code-identical to the backdoor's own Command 1/WipeMain, suggesting the wiper was cannibalized into the backdoor or vice versa; (2) a file-encryption/destruction command (Command 3, internally named RanMain/BigBangExtortMain) whose code traces to Crucio ransomware, a malware family a December 2023 CISA advisory attributed to IRGC-affiliated cyber actors following attacks on US, UK, Irish, and Israeli water and energy infrastructure; and (3) a multi-pass secure-wipe command (Command 12, WipeCMain) that is a Golang reimplementation of FlockWiper, a C-language wiper that first surfaced on VirusTotal in June 2025, months before GigaWiper's own operational debut.

Attribution linkage across the three lineages rests on shared function naming (BigBangExtortMain appears in both Crucio and GigaWiper), identical code flow, string overlap, and a recurring "GRAT" tag that appears both in FlockWiper's PDB debug paths (A:\GRAT\CWipeNew\Release\CWipeNew.pdb and E:\files\new\GRAT\CWipe\Release\CWipe.pdb) and throughout GigaWiper's internal function names — indicating the existence of an undiscovered "GRAT" development framework shared across the toolset. Google Threat Intelligence Group and Binary Defense track the family as BLUERABBIT and assess it, per Binary Defense reporting, as an Iran-nexus cluster targeting Israeli organizations, part of the same operational grouping that deployed BLUEWIPE and SEWERGOO in June 2025. Microsoft's own reporting declines to attribute a specific nation-state. Binary Defense first observed BLUERABBIT samples in March 2026; Microsoft dates the destructive activity itself to October 2025.

Operationally, GigaWiper communicates over RabbitMQ (AMQP) for command tasking — using a fanout exchange named "All" for broadcast commands and a topic exchange named "Topic" for targeted commands managed via Command 8's bind/unbind routing — and over Redis on non-standard ports for status/result reporting (fields: error, target_ip, task_id, target_computer_name, output, pwd, time, status, work_status). Both channels use an encrypted, hard-coded AES configuration. Data can be exfiltrated via a bundled MinIO client (Command 4). Persistence is established via a scheduled task named "OneDrive Update" that runs every minute plus at startup, with execution counts tracked in HKCU\SOFTWARE\OneDrive\Environment; the implant masquerades a firewall rule as "Microsoft.Windows.CloudExperienceHost" to cloak its VNC-like remote-desktop command (Command 20).

The destructive tier gives the operator three distinct escalation levers on a single infected host: Command 1 (WipeMain) enumerates physical drives via WMI, removes non-Windows-drive partition metadata via IOCTL_DISK_CREATE_DISK, and overwrites raw sectors in 0xA00000-byte chunks with a randomized (or fallback constant "1") first byte and zero-padded remainder, then forces an immediate zero-delay reboot; Command 2 triggers a BSOD via registry/boot-file deletion; Command 3 (RanMain/BigBangExtortMain) performs AES-CBC encryption in chunks with a randomly generated key/IV that is never persisted anywhere (making the encryption cryptographically unrecoverable — a "fake ransomware" that drops no ransom note and excludes .exe/.dll from encryption, deleting originals after encrypting), applying the .candy extension and dropping ./image_danger.jpg as a wallpaper; Command 12 (WipeCMain) performs FlockWiper-style multi-pass secure wiping restricted to the Windows drive — pass 1 zeros, pass 2 0xFF bytes, pass 3 random bytes, with inter-pass timing reported back to the operator.

Espionage/management tradecraft includes Command 5 (AES-256-CBC file encrypt/decrypt utility, key stored in key.txt), Command 7 (PowerShell execution appending a directory-tracking marker ";"|?????|$pwd""), Command 9 (per-monitor PNG screenshot capture), Command 10 (screen recording to C:\ProgramData\output when the user is active and the system unlocked), Command 11 (an unpopulated keylogger stub), Command 15 (system/network/firmware/AV profiling), Command 16 (process manager), Command 17 (service manager), Command 18 (interactive registry manager), Command 19 (deletion of System, Setup, Application, ForwardedEvents, and Security Windows event logs), and Command 20 (VNC-like remote desktop). Commands 6, 13, and 14 are unpopulated/unimplemented placeholders reserved for future wiper or escalation logic, underscoring the implant's modular, still-evolving design.